add report_mark_private permission

Allows user's to see the inspector panel to mark reports as Private, and
also to view those non-public reports. Useful for call centre staff who
want to record private reports but don't need to other permissions.

Fixes mysociety/fixmystreet-commercial#1213

5 files changed, 166 insertions, 3 deletions

diff --git a/t/app/controller/admin/users.t b/t/app/controller/admin/users.t
index d9e984454..903ec3104 100644
--- a/t/app/controller/admin/users.t
+++ b/t/app/controller/admin/users.t
@@ -168,6 +168,7 @@ for my $test (
 my %default_perms = (
     "permissions[moderate]" => undef,
     "permissions[planned_reports]" => undef,
+    "permissions[report_mark_private]" => undef,
     "permissions[report_edit]" => undef,
     "permissions[report_edit_category]" => undef,
     "permissions[report_edit_priority]" => undef,
diff --git a/t/app/controller/around.t b/t/app/controller/around.t
index 8eeafec7f..18281396a 100644
--- a/t/app/controller/around.t
+++ b/t/app/controller/around.t
@@ -104,7 +104,10 @@ foreach my $test (
     };
 }
 
-my @edinburgh_problems = $mech->create_problems_for_body( 5, 2651, 'Around page', {
+my $body_edin_id = $mech->create_body_ok(2651, 'City of Edinburgh Council')->id;
+my $body_west_id = $mech->create_body_ok(2504, 'Westminster City Council')->id;
+
+my @edinburgh_problems = $mech->create_problems_for_body( 5, $body_edin_id, 'Around page', {
     postcode  => 'EH1 1BB',
     latitude  => 55.9519637512,
     longitude => -3.17492254484,
@@ -128,7 +131,7 @@ subtest 'check non public reports are not displayed on around page' => sub {
         $mech->submit_form_ok( { with_fields => { pc => 'EH1 1BB' } },
             "good location" );
     };
-    $mech->content_contains( 'Around page Test 3 for 2651',
+    $mech->content_contains( "Around page Test 3 for $body_edin_id",
         'problem to be marked non public visible' );
 
     my $private = $edinburgh_problems[2];
@@ -142,10 +145,52 @@ subtest 'check non public reports are not displayed on around page' => sub {
         $mech->submit_form_ok( { with_fields => { pc => 'EH1 1BB' } },
             "good location" );
     };
-    $mech->content_lacks( 'Around page Test 3 for 2651',
+    $mech->content_lacks( "Around page Test 3 for $body_edin_id",
         'problem marked non public is not visible' );
 };
 
+for my $permission ( qw/ report_inspect report_mark_private/ ) {
+    subtest 'check non public reports are displayed on around page with $permission permission' => sub {
+        my $body = FixMyStreet::DB->resultset('Body')->find( $body_edin_id );
+        my $body2 = FixMyStreet::DB->resultset('Body')->find( $body_west_id );
+        my $user = $mech->log_in_ok( 'test@example.com' );
+        $user->user_body_permissions->delete();
+        $user->update({ from_body => $body });
+        $user->user_body_permissions->find_or_create({
+            body => $body,
+            permission_type => $permission,
+        });
+
+        $mech->get_ok('/');
+        FixMyStreet::override_config {
+            ALLOWED_COBRANDS => [ { 'fixmystreet' => '.' } ],
+            MAPIT_URL => 'http://mapit.uk/',
+        }, sub {
+            $mech->submit_form_ok( { with_fields => { pc => 'EH1 1BB' } },
+                "good location" );
+        };
+        $mech->content_contains( "Around page Test 3 for $body_edin_id",
+            'problem marked non public is visible' );
+
+        $user->user_body_permissions->delete();
+        $user->update({ from_body => $body2 });
+        $user->user_body_permissions->find_or_create({
+            body => $body2,
+            permission_type => $permission,
+        });
+
+        $mech->get_ok('/');
+        FixMyStreet::override_config {
+            ALLOWED_COBRANDS => [ { 'fixmystreet' => '.' } ],
+            MAPIT_URL => 'http://mapit.uk/',
+        }, sub {
+            $mech->submit_form_ok( { with_fields => { pc => 'EH1 1BB' } },
+                "good location" );
+        };
+        $mech->content_lacks( "Around page Test 3 for $body_edin_id",
+            'problem marked non public is not visible' );
+    };
+}
 
 my $body = $mech->create_body_ok(2237, "Oxfordshire");
 
diff --git a/t/app/controller/report_inspect.t b/t/app/controller/report_inspect.t
index e3ca33f0f..397dd1b00 100644
--- a/t/app/controller/report_inspect.t
+++ b/t/app/controller/report_inspect.t
@@ -57,12 +57,22 @@ FixMyStreet::override_config {
     subtest "test inspect page" => sub {
         $mech->get_ok("/report/$report_id");
         $mech->content_lacks('Save changes');
+        $mech->content_lacks('Private');
+        $mech->content_lacks('Priority');
+        $mech->content_lacks('Traffic management');
+        $mech->content_lacks('/admin/report_edit/'.$report_id.'">admin</a>)');
+
+        $user->user_body_permissions->create({ body => $oxon, permission_type => 'report_mark_private' });
+        $mech->get_ok("/report/$report_id");
+        $mech->content_contains('Private');
+        $mech->content_contains('Save changes');
         $mech->content_lacks('Priority');
         $mech->content_lacks('Traffic management');
         $mech->content_lacks('/admin/report_edit/'.$report_id.'">admin</a>)');
 
         $user->user_body_permissions->create({ body => $oxon, permission_type => 'report_edit_priority' });
         $mech->get_ok("/report/$report_id");
+        $mech->content_contains('Private');
         $mech->content_contains('Save changes');
         $mech->content_contains('Priority');
         $mech->content_lacks('Traffic management');
@@ -71,6 +81,7 @@ FixMyStreet::override_config {
         $user->user_body_permissions->create({ body => $oxon, permission_type => 'report_inspect' });
         $mech->get_ok("/report/$report_id");
         $mech->content_contains('Save changes');
+        $mech->content_contains('Private');
         $mech->content_contains('Priority');
         $mech->content_contains('Traffic management');
         $mech->content_lacks('/admin/report_edit/'.$report_id.'">admin</a>)');
@@ -91,7 +102,28 @@ FixMyStreet::override_config {
         $user->update({is_superuser => 0});
     };
 
+    subtest "test mark private submission" => sub {
+        $user->user_body_permissions->delete;
+        $user->user_body_permissions->create({ body => $oxon, permission_type => 'report_mark_private' });
+
+        $mech->get_ok("/report/$report_id");
+        $mech->submit_form_ok({ button => 'save', with_fields => { non_public => 1 } });
+        $report->discard_changes;
+        my $alert = FixMyStreet::App->model('DB::Alert')->find(
+            { user => $user, alert_type => 'new_updates', confirmed => 1, }
+        );
+
+        is $report->state, 'confirmed', 'report state not changed';
+        ok $report->non_public, 'report not public';
+        ok !defined( $alert ) , 'not signed up for alerts';
+
+        $report->update( { non_public => 0 } );
+    };
     subtest "test basic inspect submission" => sub {
+        $user->user_body_permissions->create({ body => $oxon, permission_type => 'report_edit_priority' });
+        $user->user_body_permissions->create({ body => $oxon, permission_type => 'report_inspect' });
+
+        $mech->get_ok("/report/$report_id");
         $mech->submit_form_ok({ button => 'save', with_fields => { traffic_information => 'Yes', state => 'Action scheduled', include_update => undef } });
         $report->discard_changes;
         my $alert = FixMyStreet::App->model('DB::Alert')->find(
diff --git a/t/app/controller/report_new.t b/t/app/controller/report_new.t
index 86d058287..6dce6711b 100644
--- a/t/app/controller/report_new.t
+++ b/t/app/controller/report_new.t
@@ -1919,6 +1919,50 @@ subtest "extra google analytics code displayed on email confirmation problem cre
     };
 };
 
+
+my $private_perms = $mech->create_user_ok('private_perms@example.org', name => 'private', from_body => $bodies[0]);
+subtest "report_mark_private allows users to mark reports as private" => sub {
+    FixMyStreet::override_config {
+        ALLOWED_COBRANDS => [ { fixmystreet => '.' } ],
+        BASE_URL => 'https://www.fixmystreet.com',
+        MAPIT_URL => 'http://mapit.uk/',
+    }, sub {
+        $mech->log_out_ok;
+
+        $private_perms->user_body_permissions->find_or_create({
+            body => $bodies[0],
+            permission_type => 'report_mark_private',
+        });
+
+        $mech->log_in_ok('private_perms@example.org');
+        $mech->get_ok('/');
+        $mech->submit_form_ok( { with_fields => { pc => 'EH1 1BB' } },
+            "submit location" );
+        $mech->follow_link_ok(
+            { text_regex => qr/skip this step/i, },
+            "follow 'skip this step' link"
+        );
+
+        $mech->submit_form_ok(
+            {
+                with_fields => {
+                    title         => "Private report",
+                    detail        => 'Private report details.',
+                    photo1        => '',
+                    name          => 'Joe Bloggs',
+                    may_show_name => '1',
+                    phone         => '07903 123 456',
+                    category      => 'Trees',
+                    non_public    => 1,
+                }
+            },
+            "submit good details"
+        );
+
+        $mech->content_contains('Great work. Now spread the word', 'shown confirmation page');
+    }
+};
+
 my $inspector = $mech->create_user_ok('inspector@example.org', name => 'inspector', from_body => $bodies[0]);
 foreach my $test (
   { non_public => 0 },
diff --git a/t/app/controller/reports.t b/t/app/controller/reports.t
index 66af2778d..3ba90c062 100644
--- a/t/app/controller/reports.t
+++ b/t/app/controller/reports.t
@@ -215,6 +215,47 @@ is scalar @$problems, 4, 'only public problems are displayed';
 
 $mech->content_lacks('All reports Test 3 for ' . $body_west_id, 'non public problem is not visible');
 
+for my $permission( qw/ report_inspect report_mark_private / ) {
+    subtest "user with $permission permission can see non public reports" => sub {
+        my $body = FixMyStreet::DB->resultset('Body')->find( $body_west_id );
+        my $body2 = FixMyStreet::DB->resultset('Body')->find( $body_edin_id );
+        my $user = $mech->log_in_ok( 'test@example.com' );
+        $user->user_body_permissions->delete();
+        $user->update({ from_body => $body });
+        $user->user_body_permissions->find_or_create({
+            body => $body,
+            permission_type => $permission,
+        });
+
+        FixMyStreet::override_config {
+            MAPIT_URL => 'http://mapit.uk/',
+        }, sub {
+            $mech->get_ok('/reports/Westminster');
+        };
+        $problems = $mech->extract_problem_list;
+        is scalar @$problems, 5, 'only public problems are displayed';
+
+        $mech->content_contains('All reports Test 3 for ' . $body_west_id, 'non public problem is visible');
+
+        $user->user_body_permissions->delete();
+        $user->update({ from_body => $body2 });
+        $user->user_body_permissions->find_or_create({
+            body => $body2,
+            permission_type => $permission,
+        });
+
+        FixMyStreet::override_config {
+            MAPIT_URL => 'http://mapit.uk/',
+        }, sub {
+            $mech->get_ok('/reports/Westminster');
+        };
+        $problems = $mech->extract_problem_list;
+        is scalar @$problems, 4, 'only public problems are displayed';
+
+        $mech->content_lacks('All reports Test 3 for ' . $body_west_id, 'non public problem is not visible');
+    };
+}
+
 # No change to numbers if report is non-public
 FixMyStreet::override_config {
     TEST_DASHBOARD_DATA => $data,